What is AI governance for a bank?
AI governance for a bank is the set of rules, people and records that decide where AI may be used, what it may do, who signs off on its work and how it is stopped. Good governance is enforced while the AI runs, not only written in a policy, so the bank can prove its controls worked.
For a credit team, that means a short list of concrete things: knowing every place AI touches credit work, sorting those uses by risk, checking each AI step against the bank's own credit rules before it takes effect, keeping decisions with people who hold delegated authority, watching results over time, being able to stop AI at once, and keeping a record that answers who, what, which rule and when.
What does the US regulatory landscape look like in 2026?
There is no single AI rulebook for US banks. Instead, several existing and new sources shape what good practice looks like. The points below were current as of October 2026. They are a summary for orientation, not legal advice, and your counsel should confirm how each applies to you.
- Model risk guidance: on April 17, 2026, the Federal Reserve, OCC and FDIC issued revised model risk management guidance (SR 26-2, OCC Bulletin 2026-13), replacing SR 11-7. It states that generative AI and agentic AI models are not within its scope, and that a bank's own risk management and governance practices should set controls for tools it does not cover.
- More to come: the agencies said they plan to issue a request for information on model risk management that considers banks' use of AI, including generative and agentic AI.
- NIST AI Risk Management Framework: a voluntary framework organized around four functions (Govern, Map, Measure, Manage), with a Generative AI Profile (NIST AI 600-1) published in July 2024. NIST says the framework is being revised.
- Fair lending and adverse action: the Equal Credit Opportunity Act and Regulation B still require specific principal reasons when credit is denied, whatever tools were used.
- Colorado: SB 26-189, signed May 14, 2026, repealed and replaced the 2024 Colorado AI Act with rules on automated decision-making technology in consequential decisions, including financial and lending services. It covers notice, explanation of adverse outcomes and a right to request meaningful human review.
- EU AI Act: AI used to evaluate the creditworthiness of individuals or set their credit score is classed as high-risk. Under amendments given final Council approval in June 2026, obligations for stand-alone high-risk systems apply from December 2, 2027. This matters to lenders with EU customers or operations.
How do you build an AI inventory?
You cannot govern what you cannot see. The inventory is a list of every place AI touches credit work, including features built into vendor products that nobody thinks of as AI. Keep it simple and keep it current. For each use, record the following.
- The task: for example spreading, memo drafting, risk grade proposals, covenant testing or collections analysis.
- The owner: the named business owner who answers for the use, not only the IT contact.
- The system and model: which product, which AI model and which vendor.
- The data: what customer and borrower information it reads, and where that data goes.
- The decision it feeds: which credit decision relies on its output, and who signs that decision.
- The controls: which rules apply, who reviews its work and how it is stopped.
How should a bank tier AI uses by risk?
Not every use deserves the same weight. A tool that summarizes a policy manual is very different from one that proposes risk grades. Tiering lets the bank put its strongest controls where the stakes are highest and move quickly on the rest. The tiers below are an example to adapt, not a standard.
| Tier | Example uses | Typical controls |
|---|---|---|
| Low | Searching policy, summarizing public information | Inventory entry, user training, spot checks |
| Medium | Reading documents, drafting memos and reviews | Source page for every figure, analyst confirmation, step records |
| High | Proposing grades, testing covenants, routing approvals, collections actions | Rules checked before each step, hold for named signer, stop control, full record, periodic testing |
| Not allowed | AI approving loans, granting waivers or changing grades alone | Blocked by rule, attempts recorded |
Why must AI rules be enforced at runtime, not only on paper?
A written AI policy tells staff and vendors what is expected. It does not stop a model from taking a step outside policy at 2 a.m. on a Sunday. Instructions given to a model inside its prompt are not a control either, because the model can misread or ignore them. The control that protects the bank is a check that runs before each AI step takes effect and sits outside the model.
Runtime enforcement works like this. The AI proposes a step: read this file, write this figure, send this draft, change this field. The step is checked against the bank's rules and gets one of four outcomes: allow, hold for a named signer, block, or stop all activity. Because the check sits outside the model, it works the same way whichever model a vendor uses, and it keeps working when the model changes.
What should be monitored once AI is live?
Governance does not end at launch. Models change, data changes and staff habits change. Monitoring should focus on signals a credit team can act on, reviewed on a set schedule by the use's owner.
- Correction rate: how often analysts change AI-proposed figures, and in which fields.
- Held and blocked steps: how many, which rules triggered them and how long holds waited for a signer.
- Override patterns: how often people overrule AI proposals, and whether some reviewers never do.
- Source gaps: figures or statements in drafts with no source page.
- Fair lending signals: outcomes across groups for any AI that influences consumer credit decisions.
- Model and vendor changes: any update to the model, prompt or vendor product, with retesting before wide use.
Who can stop AI, and how?
Every AI use above the low tier should have a stop control: a way to halt all AI activity at once, and ideally narrower stops for one workflow, one model or one data source. Decide in advance who may use it, usually the chief credit officer, the chief risk officer and an on-call operations lead, and make sure it works without the vendor's help.
Test the stop control on a schedule, the same way a bank tests disaster recovery. When it is used, record who used it, why, what was in progress and how work resumed. Our guide to the AI kill switch covers this in more detail.
What records should AI governance produce?
The record is what turns governance from a claim into evidence. For every AI step, a reviewer should be able to answer the questions below without asking the vendor.
- Who or what proposed the step, on which loan and which task.
- What evidence it used, down to the document and page.
- Which rule was checked and what the outcome was.
- Who approved a held step, and when.
- What a person changed in the AI's draft or proposal.
- Which model and which version of the bank's rules were in force at the time.
How do you roll out an AI governance framework?
Start small and make it real before making it big. A framework that governs one workflow end to end teaches a bank more than a policy that covers everything and enforces nothing.
- 1Build the inventory and name an owner for each AI use.
- 2Tier each use and agree the controls for each tier.
- 3Write the rules for one high-tier workflow from your credit policy and delegated authority matrix.
- 4Run that workflow with rules checked before each AI step, holds routed to named signers and a working stop control.
- 5Review the records weekly with credit, risk and loan review, and adjust the rules.
- 6Test the stop control and a sample of records before widening the use.
- 7Add the next workflow, and report results to the board or risk committee on a set schedule.
How Aarvion helps
Aarvion Risk OS puts governance into the credit workflow itself. The bank's credit rules and delegated authority are checked before each AI step, which is allowed, held for the right signer, blocked or stopped, and recorded with who proposed it, which rule applied, who approved it and when.
Because the checks sit outside the model, they hold when models change. Banks, credit unions and lenders typically start with a 90-day pilot on one workflow, such as spreading, memo drafting or covenant testing.
